20a2c30c019c5f4a05396d8910677244b48bae105e951c3a98586b118e3d1f15_3220.trace.hooklog Bahavior Analysis

# 25613000   LoadLibrary
    lpFileName=C:\WINDOWS\system32\IMM32.DLL
    Return=SUCCESS

# 25699000   LoadLibrary
    lpFileName=gdi32.dll
    Return=SUCCESS

# 25669000   LoadLibrary
    lpFileName=LPK.DLL
    Return=SUCCESS

# 25744000   RegQueryValue
    hKey=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\CriticalSectionTimeout
    Return=0

# 25744000   RegQueryValue
    hKey=HKEY_LOCAL_MACHINE\Software\Microsoft\Ole\RWLockResourceTimeOut
    Return=2

# 25765000   RegQueryValue
    hKey=HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
    Return=0
    type=REG_DWORD
    data=0

# 25865000   CreateFile
    hName=C:\WINDOWS\WindowsShell.Manifest
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 25892000   RegQueryValue
    hKey=HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
    Return=2

# 25893000   RegQueryValue
    hKey=HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
    Return=2

# 25894000   RegEnumValue
    hKey=HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\LanguagePack\SURR
    type=REG_DWORD
    data=2
    Return=0

# 25795000   LoadLibrary
    lpFileName=comctl32.dll
    Return=SUCCESS

# 25973000   RegQueryValue
    hKey=HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
    Return=2

# 25974000   LoadLibrary
    lpFileName=imm32.dll
    Return=SUCCESS

# 25914000   LoadLibrary
    lpFileName=comctl32.dll
    Return=SUCCESS

# 26031000   RegQueryValue
    hKey=HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel
    Return=0

# 26176000   LoadLibrary
    lpFileName=KERNEL32.DLL
    Return=SUCCESS

# 26178000   LoadLibrary
    lpFileName=KERNEL32.DLL
    Return=SUCCESS

# 26180000   LoadLibrary
    lpFileName=KERNEL32.DLL
    Return=SUCCESS

# 26189000   LoadLibrary
    lpFileName=KERNEL32.DLL
    Return=SUCCESS

# 26198000   LoadLibrary
    lpFileName=advapi32.dll
    Return=SUCCESS

# 26200000   LoadLibrary
    lpFileName=advapi32.dll
    Return=SUCCESS

# 26202000   LoadLibrary
    lpFileName=advapi32.dll
    Return=SUCCESS

# 26205000   LoadLibrary
    lpFileName=oleaut32.dll
    Return=SUCCESS

# 26206000   LoadLibrary
    lpFileName=shell32.dll
    Return=SUCCESS

# 26208000   LoadLibrary
    lpFileName=user32.dll
    Return=SUCCESS

# 26214000   LoadLibrary
    lpFileName=user32.dll
    Return=SUCCESS

# 26216000   LoadLibrary
    lpFileName=user32.dll
    Return=SUCCESS

# 26218000   LoadLibrary
    lpFileName=winmm.dll
    Return=SUCCESS

# 26220000   LoadLibrary
    lpFileName=winmm.dll
    Return=SUCCESS

# 26275000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 26275000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 26279000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26280000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26282000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26282000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26284000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26285000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26286000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26287000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26288000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26289000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26290000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26291000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26292000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26293000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26293000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26294000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26295000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26295000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26297000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26297000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26298000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26298000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26299000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26299000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26301000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26301000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26302000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26303000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26303000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26304000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26305000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26306000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26307000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26307000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26308000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26308000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26310000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26310000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26311000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26311000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26312000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26313000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26314000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26315000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26316000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26316000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26317000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26318000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26320000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26320000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26321000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26321000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26322000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26323000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26329000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26330000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26330000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26331000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26334000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26334000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26336000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26336000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26337000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26338000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26338000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26339000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26340000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26341000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26342000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26342000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26343000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26343000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26345000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26345000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26346000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26346000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26347000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26348000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26349000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26350000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26350000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26351000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26352000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26352000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26354000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26354000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26355000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26356000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26356000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26356000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26358000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26359000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26359000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26360000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26360000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26361000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26362000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26363000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26364000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26364000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26365000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26365000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26366000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26368000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26368000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26369000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26369000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26370000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26372000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26372000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26374000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26375000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26375000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26376000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26380000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 26380000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 26385000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26385000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26386000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26386000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26387000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26388000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26389000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26390000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26390000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26391000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26392000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26392000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26394000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26394000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26395000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26395000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26396000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26396000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26398000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26398000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26399000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26400000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26400000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26401000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26402000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26403000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26404000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26404000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26405000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26405000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26407000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26407000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26408000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26408000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26409000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26410000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26411000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26412000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26412000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26413000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26414000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26414000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26415000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26416000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26417000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26417000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26418000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26418000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26420000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26420000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26421000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26422000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26422000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26423000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26424000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26425000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26426000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26426000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26427000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26427000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26429000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26429000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26430000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26430000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26432000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26432000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26433000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26434000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26435000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26435000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26436000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26436000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26438000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26438000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26439000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26439000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26440000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26441000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26442000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26443000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26445000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26445000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26446000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26446000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26448000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26449000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26449000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26450000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26450000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26451000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26452000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26453000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26454000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26454000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26455000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26455000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26457000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26457000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26458000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26459000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26459000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26460000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26461000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26462000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26463000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26463000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26463000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26464000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26466000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26467000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26468000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26468000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26468000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26469000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26471000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26471000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26472000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26472000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26473000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26474000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26475000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26476000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26476000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26477000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26478000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26478000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26481000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 26481000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 26485000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26486000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26487000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26487000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26488000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26488000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26490000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26490000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26491000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26492000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26492000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26493000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26494000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26495000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26496000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26496000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26497000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26497000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26499000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26499000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26500000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26500000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26501000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26502000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26503000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26504000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26504000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26505000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26506000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26506000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26508000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26508000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26509000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26509000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26510000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26510000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26512000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26512000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26513000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26514000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26514000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26515000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26516000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26516000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26517000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26518000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26518000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26519000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26520000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26521000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26522000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26522000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26523000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26523000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26525000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26526000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26526000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26527000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26527000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26528000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26529000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26530000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26530000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26531000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26532000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26532000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26534000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26534000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26535000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26535000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26536000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26536000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26538000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26538000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26539000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26540000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26540000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26541000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26542000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26543000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26544000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26544000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26545000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26545000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26547000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26547000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26548000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26548000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26549000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26550000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26551000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26552000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26552000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26553000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26554000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26554000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26556000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26556000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26557000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26558000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26558000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26558000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26560000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26561000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26561000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26562000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26562000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26563000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26565000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26566000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26567000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26568000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26569000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26569000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26571000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26571000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26573000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26573000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26574000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26575000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26577000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26578000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26579000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26579000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26580000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26580000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26583000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 26583000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 26587000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26587000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26588000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26589000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26589000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26589000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26591000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26592000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26593000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26593000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26593000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26594000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26596000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26596000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26597000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26597000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26598000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26599000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26600000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26601000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26601000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26602000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26603000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26603000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26605000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26605000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26606000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26606000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26607000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26607000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26609000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26609000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26610000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26611000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26611000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26612000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26613000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26614000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26615000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26616000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26616000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26617000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26618000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26619000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26620000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26620000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26621000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26622000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26623000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26624000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26624000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26625000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26626000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26626000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26628000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26628000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26629000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26629000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26630000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26630000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26632000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26632000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26633000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26634000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26634000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26635000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26636000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26636000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26637000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26638000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26638000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26639000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26640000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26641000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26642000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26642000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26643000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26643000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26645000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26645000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26646000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26646000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26647000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26648000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26649000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26650000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26650000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26651000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26652000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26652000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26654000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26654000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26655000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26655000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26656000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26656000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26658000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26659000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26659000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26660000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26660000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26661000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26663000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26663000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26664000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26664000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26665000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26665000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26667000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26667000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26668000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26668000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26669000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26670000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26671000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26672000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26672000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26673000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26674000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26674000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26676000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26677000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26678000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26678000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26682000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26682000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26686000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 26686000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 26690000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26690000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26691000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26691000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26692000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26692000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26694000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26695000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26695000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26696000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26696000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26697000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26698000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26699000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26700000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26700000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26701000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26702000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26703000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26704000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26704000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26705000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26705000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26706000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26707000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26708000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26709000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26709000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26710000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26710000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26712000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26712000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26713000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26714000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26714000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26714000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26717000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26717000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26718000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26719000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26719000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26720000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26721000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26722000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26723000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26723000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26724000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26724000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26728000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26728000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26729000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26729000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26730000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26731000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26732000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26732000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26733000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26733000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26734000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26735000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26736000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26737000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26737000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26738000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26739000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26739000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26741000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26741000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26742000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26743000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26743000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26744000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26745000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26746000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26747000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26747000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26747000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26748000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26750000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26750000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26751000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26751000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26752000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26753000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26754000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26755000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26755000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26756000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26757000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26757000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26759000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26759000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26760000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26760000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26761000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26761000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26763000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26763000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26764000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26765000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26766000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26766000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26768000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26768000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26769000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26770000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26770000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26771000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26772000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26773000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26774000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26774000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26775000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26776000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26777000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26778000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26778000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26779000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26780000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26780000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26792000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 26792000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 26803000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26804000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26806000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26807000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26808000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26809000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26813000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26814000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26815000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26815000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26816000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26816000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26818000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26819000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26819000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26820000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26820000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26821000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26823000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26823000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26824000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26825000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26825000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26826000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26828000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26828000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26829000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26829000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26830000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26831000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26832000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26833000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26833000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26834000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26834000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26835000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26836000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26837000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26837000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26838000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26839000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26839000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26841000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26841000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26842000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26842000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26843000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26843000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26845000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26846000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26847000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26847000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26848000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26849000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26850000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26851000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26851000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26852000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26853000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26853000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26855000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26855000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26856000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26856000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26857000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26857000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26859000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26859000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26861000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26861000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26861000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26862000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26864000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26865000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26865000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26866000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26867000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26867000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26871000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 26871000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 26875000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26875000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26876000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26876000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26877000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26878000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26879000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26880000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26881000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26881000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26882000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26882000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26884000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26884000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26885000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26885000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26886000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26887000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26889000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26889000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26890000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26890000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26891000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26891000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26893000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26893000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26894000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26895000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26895000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26896000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26898000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26898000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26899000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26899000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26900000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26901000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26902000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26903000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26903000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26904000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26905000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26905000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26907000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26907000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26908000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26909000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26909000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26910000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26912000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26912000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26913000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26913000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26914000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26915000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26916000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26917000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26917000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26918000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26919000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26919000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26921000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26921000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26922000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26923000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26923000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26924000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26925000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26926000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26927000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26927000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26928000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26929000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26930000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26931000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26931000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26932000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26933000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26933000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26935000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26936000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26936000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26937000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26938000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26938000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26940000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26940000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26941000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26942000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26942000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26943000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26944000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26945000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26946000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26946000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26947000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26947000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26949000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26950000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26950000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26951000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26952000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26952000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26954000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26954000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26955000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26955000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26956000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26956000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26958000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26959000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26960000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26960000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26961000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26961000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26963000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26963000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26964000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26965000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26966000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26966000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26968000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26968000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26969000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26970000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26970000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26971000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26974000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 26974000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 26978000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26979000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26980000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26980000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26981000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26981000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26983000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26984000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26984000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26985000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26986000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26986000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26988000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26988000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26989000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26990000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26990000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26991000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26992000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26993000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26994000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26994000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26995000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26995000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26997000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 26998000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 26998000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 26999000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 26999000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27000000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27001000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27002000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27002000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27003000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27004000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27004000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27006000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27006000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27007000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27008000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27008000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27009000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27010000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27011000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27012000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27012000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27013000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27014000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27015000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27016000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27016000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27017000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27018000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27018000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27020000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27020000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27021000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27021000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27022000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27022000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27024000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27024000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27025000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27026000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27026000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27027000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27029000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27029000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27030000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27030000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27031000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27032000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27033000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27034000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27034000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27035000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27036000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27036000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27038000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27038000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27039000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27040000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27040000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27041000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27042000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27043000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27044000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27044000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27045000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27045000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27047000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27047000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27048000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27048000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27049000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27050000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27052000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27052000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27053000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27053000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27054000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27054000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27056000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27056000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27057000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27058000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27058000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27059000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27060000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27061000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27062000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27062000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27063000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27064000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27066000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27066000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27067000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27067000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27068000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27068000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27072000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27072000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27076000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27076000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27077000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27078000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27078000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27079000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27080000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27081000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27082000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27082000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27083000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27083000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27084000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27091000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27092000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27092000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27093000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27093000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27095000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27096000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27096000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27097000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27097000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27098000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27100000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27100000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27101000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27102000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27103000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27103000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27105000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27105000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27106000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27106000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27107000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27108000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27109000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27110000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27111000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27111000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27112000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27112000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27114000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27114000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27115000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27115000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27116000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27117000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27118000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27119000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27119000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27120000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27121000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27121000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27123000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27123000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27124000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27124000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27125000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27125000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27127000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27128000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27128000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27129000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27129000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27130000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27131000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27132000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27133000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27133000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27134000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27135000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27136000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27137000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27137000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27138000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27139000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27139000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27141000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27141000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27142000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27142000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27143000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27143000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27145000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27145000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27146000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27147000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27147000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27148000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27149000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27150000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27151000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27151000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27152000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27152000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27154000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27154000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27155000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27155000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27156000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27157000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27158000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27159000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27159000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27160000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27161000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27161000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27163000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27163000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27164000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27165000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27165000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27166000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27167000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27168000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27169000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27169000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27170000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27171000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27173000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27173000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27177000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27178000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27179000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27179000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27180000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27180000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27182000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27182000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27183000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27183000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27184000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27185000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27186000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27187000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27187000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27188000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27189000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27189000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27191000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27191000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27192000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27192000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27193000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27193000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27195000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27196000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27196000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27197000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27197000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27198000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27199000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27200000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27201000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27201000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27202000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27202000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27204000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27205000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27205000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27205000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27206000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27207000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27209000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27209000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27210000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27210000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27211000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27211000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27214000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27214000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27215000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27216000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27216000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27219000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27221000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27221000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27222000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27222000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27223000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27223000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27225000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27225000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27226000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27227000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27227000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27228000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27229000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27230000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27231000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27231000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27232000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27232000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27233000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27234000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27235000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27235000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27236000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27236000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27238000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27238000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27239000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27240000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27240000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27241000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27243000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27243000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27244000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27244000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27245000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27245000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27247000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27247000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27248000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27249000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27249000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27250000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27251000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27252000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27253000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27253000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27255000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27255000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27259000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27263000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27264000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27267000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27267000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27268000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27273000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27273000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27281000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27282000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27283000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27283000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27284000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27285000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27286000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27287000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27288000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27288000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27289000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27289000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27291000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27291000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27292000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27292000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27293000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27294000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27295000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27296000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27296000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27297000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27298000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27298000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27300000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27300000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27301000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27301000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27302000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27302000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27304000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27304000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27305000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27306000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27306000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27307000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27309000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27309000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27310000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27310000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27311000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27312000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27314000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27314000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27315000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27316000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27316000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27317000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27318000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27319000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27320000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27320000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27321000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27321000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27323000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27324000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27324000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27325000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27325000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27326000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27328000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27328000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27329000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27329000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27330000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27330000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27332000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27332000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27333000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27334000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27334000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27334000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27336000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27336000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27337000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27338000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27338000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27339000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27340000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27341000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27342000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27342000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27343000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27343000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27345000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27345000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27346000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27346000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27347000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27348000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27349000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27350000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27350000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27351000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27352000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27352000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27354000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27354000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27355000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27355000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27356000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27356000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27358000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27358000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27359000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27360000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27360000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27361000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27362000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27363000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27364000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27364000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27365000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27365000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27367000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27368000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27368000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27369000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27370000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27370000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27373000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27373000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27377000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27378000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27378000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27379000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27380000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27380000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27382000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27382000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27383000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27383000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27384000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27384000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27386000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27386000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27387000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27387000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27388000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27388000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27390000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27390000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27391000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27392000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27392000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27393000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27394000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27395000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27396000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27396000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27397000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27397000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27399000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27399000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27400000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27400000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27401000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27402000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27403000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27404000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27404000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27405000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27406000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27406000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27408000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27408000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27409000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27409000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27410000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27410000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27412000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27413000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27413000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27414000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27414000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27415000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27416000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27417000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27418000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27418000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27419000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27419000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27421000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27422000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27422000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27423000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27423000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27424000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27426000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27426000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27427000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27427000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27428000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27428000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27430000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27430000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27431000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27432000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27432000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27433000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27435000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27435000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27436000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27437000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27437000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27438000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27439000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27440000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27441000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27441000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27442000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27442000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27444000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27444000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27445000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27445000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27446000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27447000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27448000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27449000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27449000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27450000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27451000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27451000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27453000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27453000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27454000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27455000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27455000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27456000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27457000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27458000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27459000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27459000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27459000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27460000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27462000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27462000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27463000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27463000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27464000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27465000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27466000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27467000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27467000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27468000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27469000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27469000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27473000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27473000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27476000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27477000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27477000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27478000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27479000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27479000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27481000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27481000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27482000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27482000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27483000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27483000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27485000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27485000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27486000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27487000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27487000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27488000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27489000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27490000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27491000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27491000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27492000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27492000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27494000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27494000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27495000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27495000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27496000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27497000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27498000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27499000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27499000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27500000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27501000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27501000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27503000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27503000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27504000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27504000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27505000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27505000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27507000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27508000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27509000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27509000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27509000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27510000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27512000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27512000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27513000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27513000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27514000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27515000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27516000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27517000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27517000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27518000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27518000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27519000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27520000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27521000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27522000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27522000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27523000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27523000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27525000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27525000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27526000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27527000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27527000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27528000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27529000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27530000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27531000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27531000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27532000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27532000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27533000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27534000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27535000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27535000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27536000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27536000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27538000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27538000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27539000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27539000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27540000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27541000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27542000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27543000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27543000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27544000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27545000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27545000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27547000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27547000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27548000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27548000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27549000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27549000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27551000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27552000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27553000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27553000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27554000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27554000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27556000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27557000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27557000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27557000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27558000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27559000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27560000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27561000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27561000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27562000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27563000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27563000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27565000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27565000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27566000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27567000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27567000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27568000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27571000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27571000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27575000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27575000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27576000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27577000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27577000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27578000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27579000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27580000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27581000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27581000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27582000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27582000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27584000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27585000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27586000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27586000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27587000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27587000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27589000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27589000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27590000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27590000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27591000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27592000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27593000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27594000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27594000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27595000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27596000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27596000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27598000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27598000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27599000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27599000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27600000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27600000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27602000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27602000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27603000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27604000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27604000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27605000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27606000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27607000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27608000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27608000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27609000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27610000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27611000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27612000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27612000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27613000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27614000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27614000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27616000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27616000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27617000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27617000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27618000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27618000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27620000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27620000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27621000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27622000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27622000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27623000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27624000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27625000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27626000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27626000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27627000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27627000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27629000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27629000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27630000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27630000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27631000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27632000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27633000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27633000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27634000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27634000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27635000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27636000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27637000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27638000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27638000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27639000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27640000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27640000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27642000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27642000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27643000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27643000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27644000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27644000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27646000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27646000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27647000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27648000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27648000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27649000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27650000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27651000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27652000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27652000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27653000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27653000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27655000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27655000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27656000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27656000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27657000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27658000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27659000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27660000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27660000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27661000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27662000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27662000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27664000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27664000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27665000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27666000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27666000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27667000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27670000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27670000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27674000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27674000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27675000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27675000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27676000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27676000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27678000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27678000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27679000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27680000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27680000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27681000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27682000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27683000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27683000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27684000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27684000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27685000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27686000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27687000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27688000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27688000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27689000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27689000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27691000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27691000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27692000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27692000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27693000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27694000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27695000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27696000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27696000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27697000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27698000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27698000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27700000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27700000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27701000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27701000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27702000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27702000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27704000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27704000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27705000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27706000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27707000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27707000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27709000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27709000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27710000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27710000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27711000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27712000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27713000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27714000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27714000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27715000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27715000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27716000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27718000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27719000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27720000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27720000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27721000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27721000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27723000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27724000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27724000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27725000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27726000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27726000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27728000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27728000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27729000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27729000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27730000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27730000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27732000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27732000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27734000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27734000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27735000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27735000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27737000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27737000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27738000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27739000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27739000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27740000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27741000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27742000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27743000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27743000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27744000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27744000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27746000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27746000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27747000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27747000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27748000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27749000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27750000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27751000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27751000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27752000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27753000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27753000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27755000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27755000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27756000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27756000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27757000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27757000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27759000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27759000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27760000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27761000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27761000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27762000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27764000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27764000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27765000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27765000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27766000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27767000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27770000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27770000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27774000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27775000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27775000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27776000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27777000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27777000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27779000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27779000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27780000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27781000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27781000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27782000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27783000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27784000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27785000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27785000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27786000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27786000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27788000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27789000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27791000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27791000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27792000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27793000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27794000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27795000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27795000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27796000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27797000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27797000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27799000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27799000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27800000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27801000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27802000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27802000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27804000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27804000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27805000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27806000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27806000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27807000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27809000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27809000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27810000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27810000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27811000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27812000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27814000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27814000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27815000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27815000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27816000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27816000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27818000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27819000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27819000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27820000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27820000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27821000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27822000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27823000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27824000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27824000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27825000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27825000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27827000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27828000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27828000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27829000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27829000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27830000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27831000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27832000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27832000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27833000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27834000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27834000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27836000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27836000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27837000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27838000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27838000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27839000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27840000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27841000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27842000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27842000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27842000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27843000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27845000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27845000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27846000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27846000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27847000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27847000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27849000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27850000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27850000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27851000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27851000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27852000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27853000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27854000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27855000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27855000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27856000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27856000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27858000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27858000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27859000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27860000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27860000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27861000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27862000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27863000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27864000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27864000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27865000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27865000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27867000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27868000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27868000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27869000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27870000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27870000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27873000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27873000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27877000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27877000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27878000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27878000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27879000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27880000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27881000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27882000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27882000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27883000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27883000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27884000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27885000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27886000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27886000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27887000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27888000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27888000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27890000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27890000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27891000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27891000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27892000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27892000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27894000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27894000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27895000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27896000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27896000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27897000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27898000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27899000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27900000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27900000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27901000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27901000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27903000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27903000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27904000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27904000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27905000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27906000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27908000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27908000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27909000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27909000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27910000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27910000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27912000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27912000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27913000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27914000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27914000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27915000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27916000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27917000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27918000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27918000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27919000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27919000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27921000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27921000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27922000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27922000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27923000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27924000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27925000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27926000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27926000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27927000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27928000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27928000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27930000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27930000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27931000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27931000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27932000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27932000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27934000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27934000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27935000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27935000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27936000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27936000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27938000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27938000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27939000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27940000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27940000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27941000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27942000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27943000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27944000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27944000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27945000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27945000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27947000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27947000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27948000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27948000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27949000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27950000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27951000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27952000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27952000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27953000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27954000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27954000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27956000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27956000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27957000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27957000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27958000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27958000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27960000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27960000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27961000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27962000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27962000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27963000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27965000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27965000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27966000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27966000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27967000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27968000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27971000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 27971000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 27974000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27975000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27976000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27976000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27977000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27978000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27979000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27980000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27980000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27981000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27982000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27982000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27984000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27985000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27985000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27986000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27987000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27987000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27989000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27989000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27990000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27990000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27991000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27991000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27993000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27993000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27994000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27995000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27995000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27996000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 27997000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 27998000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 27999000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 27999000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28000000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28000000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28002000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28002000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28003000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28003000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28004000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28005000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28006000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28007000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28008000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28008000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28009000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28009000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28011000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28011000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28012000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28013000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28013000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28014000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28015000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28016000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28017000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28017000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28017000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28018000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28020000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28020000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28021000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28021000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28022000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28023000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28024000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28025000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28025000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28026000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28027000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28027000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28029000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28029000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28030000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28030000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28031000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28031000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28033000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28033000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28034000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28034000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28035000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28035000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28037000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28037000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28038000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28039000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28039000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28040000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28041000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28042000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28043000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28043000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28043000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28044000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28046000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28046000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28047000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28047000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28048000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28049000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28050000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28051000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28051000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28052000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28052000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28053000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28054000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28055000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28056000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28056000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28057000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28057000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28059000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28059000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28060000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28061000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28061000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28062000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28064000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28064000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28065000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28065000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28066000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28067000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28071000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28071000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28076000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28077000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28077000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28078000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28079000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28079000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28081000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28081000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28082000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28082000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28084000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28084000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28086000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28086000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28087000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28088000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28088000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28089000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28090000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28091000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28092000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28092000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28093000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28093000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28095000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28095000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28096000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28096000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28097000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28098000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28099000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28100000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28100000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28101000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28102000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28102000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28104000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28104000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28105000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28105000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28106000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28106000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28108000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28109000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28109000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28110000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28110000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28111000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28112000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28113000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28114000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28114000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28115000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28115000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28117000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28117000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28118000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28118000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28119000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28120000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28121000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28122000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28122000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28123000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28124000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28124000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28126000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28126000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28127000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28127000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28128000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28128000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28130000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28131000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28132000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28132000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28133000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28133000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28135000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28135000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28136000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28136000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28137000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28138000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28139000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28140000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28140000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28141000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28142000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28142000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28144000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28144000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28145000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28146000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28146000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28146000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28148000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28149000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28149000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28150000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28151000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28151000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28153000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28153000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28154000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28154000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28155000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28156000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28157000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28158000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28158000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28159000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28160000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28160000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28162000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28162000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28163000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28164000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28164000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28165000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28166000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28167000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28168000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28168000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28169000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28169000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28173000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28173000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28176000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28177000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28178000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28178000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28179000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28179000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28181000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28181000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28182000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28182000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28183000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28184000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28185000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28186000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28186000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28187000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28188000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28188000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28190000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28190000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28191000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28191000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28192000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28192000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28194000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28194000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28195000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28196000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28196000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28197000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28198000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28199000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28200000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28200000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28201000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28201000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28203000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28203000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28204000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28204000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28205000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28206000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28207000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28208000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28209000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28209000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28210000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28210000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28212000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28212000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28213000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28214000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28214000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28214000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28216000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28217000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28218000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28219000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28220000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28220000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28222000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28222000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28223000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28223000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28224000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28224000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28226000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28227000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28227000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28228000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28228000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28229000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28231000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28231000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28232000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28232000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28233000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28233000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28235000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28235000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28236000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28236000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28237000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28238000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28239000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28240000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28240000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28241000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28242000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28242000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28244000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28244000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28245000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28245000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28246000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28246000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28248000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28248000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28249000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28250000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28250000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28251000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28252000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28253000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28254000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28254000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28255000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28256000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28257000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28258000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28258000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28259000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28260000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28260000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28262000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28262000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28263000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28264000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28264000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28265000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28267000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28267000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28268000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28268000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28269000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28270000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28273000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28273000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28277000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28278000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28278000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28279000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28279000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28280000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28282000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28282000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28283000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28284000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28285000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28285000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28287000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28287000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28288000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28288000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28289000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28290000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28291000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28292000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28293000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28294000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28295000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28295000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28297000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28297000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28298000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28298000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28299000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28299000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28301000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28301000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28302000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28303000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28303000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28304000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28305000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28306000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28307000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28307000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28308000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28309000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28310000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28311000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28312000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28313000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28313000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28314000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28315000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28316000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28317000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28317000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28318000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28318000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28320000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28320000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28321000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28321000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28322000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28323000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28324000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28325000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28325000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28326000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28327000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28327000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28329000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28329000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28330000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28330000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28331000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28331000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28333000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28333000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28334000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28334000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28335000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28335000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28337000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28337000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28338000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28339000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28339000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28340000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28341000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28342000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28343000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28343000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28344000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28344000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28346000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28347000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28347000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28347000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28348000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28349000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28350000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28351000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28351000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28352000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28353000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28353000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28355000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28355000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28356000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28356000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28357000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28357000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28359000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28360000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28360000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28361000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28361000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28362000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28364000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28365000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28365000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28366000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28366000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28367000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28370000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28370000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28374000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28374000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28375000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28376000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28376000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28377000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28379000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28379000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28380000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28380000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28381000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28381000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28384000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28384000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28385000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28385000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28386000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28386000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28388000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28388000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28389000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28390000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28390000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28391000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28392000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28393000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28394000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28394000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28395000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28396000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28397000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28398000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28398000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28399000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28399000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28400000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28402000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28402000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28403000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28403000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28404000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28404000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28406000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28406000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28407000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28408000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28408000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28409000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28410000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28411000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28412000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28412000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28413000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28413000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28415000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28416000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28416000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28417000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28417000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28418000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28420000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28420000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28421000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28421000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28422000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28422000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28424000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28424000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28425000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28426000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28426000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28427000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28428000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28429000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28430000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28430000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28431000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28432000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28433000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28433000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28434000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28434000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28435000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28436000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28437000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28438000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28438000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28439000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28440000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28440000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28442000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28442000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28443000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28443000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28444000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28444000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28446000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28447000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28448000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28448000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28449000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28449000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28451000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28451000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28452000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28452000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28453000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28454000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28455000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28456000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28457000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28457000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28458000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28458000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28460000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28460000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28462000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28462000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28463000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28463000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28466000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28466000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28467000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28468000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28469000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28470000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28474000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28474000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28478000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28478000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28479000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28480000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28480000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28481000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28482000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28483000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28484000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28484000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28485000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28485000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28487000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28488000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28488000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28489000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28490000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28490000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28492000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28492000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28493000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28493000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28494000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28494000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28496000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28497000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28497000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28498000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28498000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28499000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28501000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28502000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28503000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28503000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28504000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28504000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28506000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28506000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28507000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28508000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28509000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28509000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28511000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28512000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28512000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28513000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28514000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28514000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28516000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28516000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28517000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28517000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28518000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28519000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28520000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28521000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28522000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28522000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28523000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28523000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28525000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28526000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28526000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28527000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28528000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28528000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28530000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28530000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28531000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28531000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28532000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28533000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28534000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28535000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28536000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28536000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28537000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28537000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28539000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28539000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28540000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28541000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28541000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28542000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28543000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28544000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28545000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28545000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28546000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28546000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28548000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28548000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28549000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28549000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28550000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28551000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28553000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28553000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28554000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28554000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28555000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28555000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28557000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28557000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28558000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28559000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28559000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28560000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28562000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28562000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28563000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28563000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28564000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28565000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28567000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28567000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28568000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28569000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28569000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28570000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28573000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28573000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28577000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28578000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28579000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28579000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28580000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28580000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28582000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28583000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28583000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28584000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28585000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28585000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28587000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28587000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28588000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28589000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28589000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28590000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28591000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28592000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28593000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28593000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28594000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28594000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28596000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28596000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28597000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28597000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28598000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28599000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28600000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28601000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28602000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28602000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28603000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28603000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28605000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28605000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28606000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28607000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28607000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28608000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28610000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28610000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28612000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28613000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28613000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28614000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28615000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28616000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28617000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28617000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28618000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28618000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28620000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28620000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28621000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28621000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28622000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28623000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28624000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28625000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28626000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28626000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28627000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28627000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28629000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28629000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28630000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28631000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28631000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28632000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28633000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28633000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28634000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28635000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28635000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28636000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28637000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28638000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28639000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28639000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28640000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28641000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28642000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28643000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28643000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28644000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28645000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28645000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28647000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28647000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28648000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28648000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28649000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28649000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28651000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28651000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28652000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28653000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28654000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28655000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28658000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28661000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28663000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28663000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28665000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28665000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28668000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28668000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28669000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28669000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28670000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28671000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28674000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28674000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28678000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28679000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28680000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28680000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28681000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28682000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28683000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28684000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28684000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28684000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28685000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28686000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28688000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28688000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28689000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28689000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28690000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28690000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28692000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28693000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28693000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28694000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28694000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28695000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28697000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28697000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28698000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28698000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28699000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28700000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28701000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28702000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28702000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28703000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28704000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28704000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28706000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28707000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28708000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28708000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28709000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28709000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28711000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28712000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28712000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28713000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28713000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28714000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28716000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28716000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28717000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28719000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28719000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28720000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28722000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28722000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28723000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28723000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28724000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28724000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28726000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28727000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28728000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28728000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28729000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28729000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28731000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28731000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28732000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28732000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28733000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28734000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28735000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28736000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28736000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28737000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28738000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28738000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28740000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28740000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28741000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28742000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28742000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28743000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28744000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28745000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28746000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28746000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28747000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28747000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28749000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28750000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28750000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28751000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28752000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28752000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28754000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28754000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28755000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28755000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28756000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28756000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28758000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28759000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28759000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28760000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28760000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28761000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28763000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28764000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28765000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28766000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28767000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28768000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28772000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28772000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28776000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28777000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28778000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28778000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28779000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28779000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28781000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28781000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28782000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28783000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28784000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28784000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28786000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28786000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28787000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28787000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28788000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28788000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28791000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28792000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28794000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28795000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28797000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28797000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28800000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28801000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28802000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28803000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28804000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28805000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28807000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28808000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28809000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28811000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28811000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28811000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28813000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28814000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28815000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28815000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28816000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28817000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28818000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28819000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28819000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28820000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28821000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28821000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28823000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28823000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28824000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28825000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28825000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28825000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28827000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28828000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28829000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28829000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28830000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28830000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28832000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28832000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28833000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28833000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28834000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28835000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28836000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28837000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28837000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28838000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28839000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28839000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28841000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28841000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28842000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28843000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28843000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28844000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28845000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28846000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28847000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28847000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28847000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28848000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28850000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28850000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28851000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28851000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28852000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28853000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28854000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28855000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28855000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28856000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28857000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28857000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28859000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28859000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28860000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28861000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28862000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28862000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28864000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28865000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28865000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28866000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28866000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28867000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28870000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28870000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28874000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28875000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28876000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28876000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28877000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28877000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28879000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28880000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28880000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28881000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28882000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28882000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28884000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28884000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28885000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28885000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28886000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28886000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28888000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28888000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28889000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28890000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28890000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28891000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28893000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28893000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28894000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28894000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28895000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28896000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28899000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28899000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28900000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28900000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28901000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28902000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28904000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28905000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28906000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28906000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28907000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28907000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28909000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28910000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28910000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28910000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28911000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28911000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28913000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28914000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28914000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28915000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28915000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28916000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28918000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28918000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28919000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28919000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28920000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28920000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28922000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28922000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28923000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28924000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28924000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28925000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28926000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28927000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28928000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28928000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28929000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28929000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28931000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28931000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28932000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28932000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28933000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28934000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28935000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28936000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28936000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28937000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28938000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28938000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28940000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28940000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28941000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28941000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28942000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28942000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28944000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28944000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28945000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28946000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28946000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28946000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28948000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28948000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28949000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28950000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28950000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28951000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28952000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28953000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28954000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28954000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28955000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28955000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28957000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28957000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28958000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28958000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28959000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28960000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28962000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28963000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28963000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28964000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28965000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28965000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28969000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 28969000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 28972000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28973000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28973000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28974000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28975000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28975000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28977000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28977000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28978000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28979000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28979000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28980000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28981000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28982000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28983000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28983000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28984000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28984000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28986000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28986000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28987000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28987000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28988000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28989000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28990000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28991000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28991000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28992000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28993000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28993000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28995000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28995000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 28996000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28996000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28997000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 28997000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 28999000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 28999000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29000000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29001000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29001000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29002000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29003000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29004000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29005000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29005000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29006000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29006000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29008000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29009000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29009000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29009000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29010000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29010000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29012000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29013000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29013000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29013000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29014000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29015000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29016000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29017000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29017000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29018000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29019000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29019000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29021000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29021000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29022000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29022000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29023000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29023000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29025000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29026000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29026000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29027000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29027000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29028000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29029000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29030000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29031000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29031000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29032000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29032000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29034000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29035000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29035000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29036000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29036000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29037000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29038000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29039000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29039000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29040000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29041000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29041000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29043000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29043000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29044000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29045000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29045000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29045000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29047000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29048000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29048000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29049000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29049000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29050000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29051000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29052000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29053000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29053000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29054000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29054000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29056000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29057000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29057000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29058000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29058000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29059000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29061000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29062000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29062000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29063000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29064000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29064000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29068000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 29068000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 29071000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29072000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29072000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29073000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29074000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29074000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29076000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29076000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29077000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29077000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29078000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29078000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29080000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29081000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29081000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29082000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29082000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29083000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29084000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29085000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29086000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29086000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29087000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29087000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29089000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29090000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29090000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29091000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29091000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29092000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29093000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29094000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29094000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29095000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29096000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29096000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29098000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29098000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29099000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29099000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29100000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29100000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29102000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29102000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29103000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29104000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29105000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29105000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29107000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29107000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29108000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29108000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29109000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29110000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29111000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29112000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29113000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29113000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29114000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29114000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29116000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29116000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29117000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29118000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29118000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29118000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29120000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29121000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29121000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29122000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29122000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29123000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29125000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29125000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29126000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29126000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29127000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29128000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29129000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29130000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29130000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29131000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29131000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29132000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29134000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29134000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29135000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29135000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29136000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29136000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29138000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29138000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29139000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29140000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29140000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29141000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29142000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29143000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29143000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29144000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29144000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29145000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29146000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29147000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29148000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29148000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29149000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29149000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29151000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29152000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29152000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29152000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29153000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29154000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29155000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29156000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29156000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29157000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29158000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29158000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29160000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29160000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29161000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29161000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29162000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29162000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29164000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29165000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29166000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29166000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29167000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29167000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29170000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 29170000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 29174000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29175000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29175000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29176000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29176000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29177000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29178000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29179000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29180000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29180000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29180000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29181000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29183000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29183000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29184000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29184000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29185000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29186000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29187000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29188000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29188000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29189000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29189000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29190000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29192000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29192000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29193000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29194000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29194000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29195000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29197000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29197000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29198000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29198000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29199000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29199000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29201000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29201000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29202000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29203000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29203000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29203000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29205000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29206000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29207000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29207000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29208000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29208000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29210000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29210000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29211000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29211000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29212000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29212000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29214000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29214000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29216000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29217000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29217000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29218000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29219000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29220000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29221000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29221000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29222000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29222000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29224000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29225000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29227000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29227000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29229000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29230000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29233000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29234000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29235000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29236000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29237000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29238000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29240000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29241000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29241000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29242000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29243000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29243000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29245000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29246000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29247000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29247000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29248000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29249000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29250000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29251000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29252000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29252000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29253000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29253000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29255000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29255000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29256000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29257000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29257000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29258000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29259000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29260000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29261000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29262000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29262000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29263000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29265000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29265000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29266000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29266000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29267000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29268000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29271000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 29271000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 29274000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29275000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29276000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29276000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29277000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29277000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29279000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29280000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29280000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29280000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29281000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29282000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29283000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29284000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29284000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29285000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29286000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29286000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29288000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29288000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29289000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29289000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29290000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29291000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29294000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29294000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29295000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29295000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29296000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29296000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29298000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29298000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29299000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29300000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29300000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29300000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29302000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29303000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29303000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29304000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29305000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29305000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29307000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29307000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29308000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29308000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29310000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29310000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29312000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29312000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29313000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29314000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29314000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29314000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29316000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29317000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29317000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29318000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29318000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29319000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29320000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29321000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29322000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29322000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29323000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29324000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29325000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29326000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29326000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29327000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29328000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29328000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29330000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29330000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29331000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29331000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29332000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29332000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29334000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29334000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29335000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29336000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29336000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29337000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29338000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29339000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29340000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29340000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29341000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29341000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29343000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29343000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29344000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29344000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29345000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29346000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29347000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29348000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29348000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29349000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29350000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29350000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29353000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29353000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29358000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29358000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29359000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29360000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29364000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29365000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29366000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29366000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29369000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29370000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29375000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 29375000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 29379000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29379000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29380000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29380000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29381000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29382000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29383000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29384000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29384000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29385000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29386000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29386000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29388000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29388000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29389000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29389000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29390000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29390000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29392000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29392000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29393000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29394000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29394000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29395000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29396000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29397000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29398000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29398000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29398000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29399000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29401000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29401000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29402000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29402000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29403000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29404000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29405000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29406000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29406000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29407000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29408000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29408000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29410000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29411000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29411000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29412000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29413000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29413000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29415000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29415000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29416000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29416000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29417000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29417000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29419000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29419000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29420000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29421000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29421000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29422000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29423000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29424000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29425000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29425000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29426000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29426000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29428000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29429000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29429000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29429000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29430000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29431000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29432000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29433000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29433000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29434000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29435000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29435000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29437000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29437000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29438000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29438000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29439000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29439000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29441000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29442000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29442000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29443000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29443000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29444000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29445000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29446000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29447000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29447000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29448000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29448000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29450000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29451000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29451000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29451000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29452000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29453000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29454000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29455000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29455000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29456000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29457000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29457000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29459000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29459000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29460000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29461000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29461000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29462000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29463000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29464000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29465000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29465000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29466000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29466000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29469000   CreateFile
    hName=C:\WINDOWS\system32\config\Rundll32.exe
    desiredAccess=GENERIC_READ 
    creationDisposition=OPEN_EXISTING
    Return=SUCCESS

# 29469000   CopyFile
    lpExistingFileName=C:\WINDOWS\system32\config\Rundll32.exe
    lpNewFileName=\prueba
    Return=SUCCESS

# 29473000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29474000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29475000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29475000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29476000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29476000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29478000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29478000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29479000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29479000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29480000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29481000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29482000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29483000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29483000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29484000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29485000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29485000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29487000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29487000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29488000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29488000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29489000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29489000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29491000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29491000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29492000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29493000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29493000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29494000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29495000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29496000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29497000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29497000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29498000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29498000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29500000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29500000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29501000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29501000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29502000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29503000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29504000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29505000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29505000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29506000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29507000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29507000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29509000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29509000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29510000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29510000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29511000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29511000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0

# 29513000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
    Return=0

# 29513000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
    type=REG_SZ
    data=www.facebook.com
    Return=0

# 29514000   RegCreateKey
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Return=0

# 29514000   RegSetValue
    hKey=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32
    type=REG_SZ
    data=C:\WINDOWS\system32\Rundll32.exe
    Return=0